GCP logs JSON Extract – Load into BigQuery

Use JSON Extract  - JSON_EXTRACT protopayload_auditlog.metadataJsontableDataRead

SELECT REGEXP_EXTRACT(protopayload_auditlog.resourceName, '^projects/[^/]+/datasets/([^/]+)/tables') AS datasetRef,
COUNTIF(JSON_EXTRACT(protopayload_auditlog.metadataJson, "$.tableDataRead") IS NOT NULL) AS dataReadEvents,
FROM myproject.cloudaudit_googleapis_com_data_access_2019*
WHERE
JSON_EXTRACT(protopayload_auditlog.metadataJson, "$.tableDataRead") IS NOT NULL
GROUP BY datasetRef
ORDER BY dataReadEvents DESC
LIMIT 5